Commit 488d7c45 authored Jun 06, 2017 by Su Yue Committed by David Sterba Jun 21, 2017

btrfs: Check name_len before reading btrfs_get_name



In btrfs_get_name, there's btrfs_search_slot and reads name from
inode_ref/root_ref.

Call btrfs_is_name_len_valid in btrfs_get_name.

Signed-off-by: Su Yue <suy.fnst@cn.fujitsu.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

parent 59b0a7f2

fs/btrfs/export.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -282,6 +282,11 @@ static int btrfs_get_name(struct dentry parent, char name,
		name_len = btrfs_inode_ref_name_len(leaf, iref);
		}

		ret = btrfs_is_name_len_valid(leaf, path->slots[0], name_ptr, name_len);
		if (!ret) {
		btrfs_free_path(path);
		return -EIO;
		}
		read_extent_buffer(leaf, name, name_ptr, name_len);
		btrfs_free_path(path);